import re import urllib # set of SSL/TLS capable hosts secure_hosts = set() def request(flow): flow.request.headers.pop('If-Modified-Since', None) flow.request.headers.pop('Cache-Control', None) # do not force https redirection flow.request.headers.pop('Upgrade-Insecure-Requests', None) # proxy connections to SSL-enabled hosts if flow.request.pretty_host in secure_hosts: flow.request.scheme = 'https' flow.request.port = 443 def response(flow): flow.response.headers.pop('Strict-Transport-Security', None) flow.response.headers.pop('Public-Key-Pins', None) # strip links in response body flow.response.content = flow.response.content.replace('https://', 'http://') # strip meta tag upgrade-insecure-requests in response body csp_meta_tag_pattern = b'' flow.response.content = re.sub(csp_meta_tag_pattern, b'', flow.response.content, flags=re.IGNORECASE) # strip links in 'Location' header if flow.response.headers.get('Location', '').startswith('https://'): location = flow.response.headers['Location'] hostname = urllib.parse.urlparse(location).hostname if hostname: secure_hosts.add(hostname) flow.response.headers['Location'] = location.replace('https://', 'http://', 1) # strip upgrade-insecure-requests in Content-Security-Policy header if re.search('upgrade-insecure-requests', flow.response.headers.get('Content-Security-Policy', ''), flags=re.IGNORECASE): csp = flow.response.headers['Content-Security-Policy'] flow.response.headers['Content-Security-Policy'] = re.sub('upgrade-insecure-requests[;\s]*', '', csp, flags=re.IGNORECASE) # strip secure flag from 'Set-Cookie' headers cookies = flow.response.headers.get_all('Set-Cookie') cookies = [re.sub(r';\s*secure\s*', '', s) for s in cookies] flow.response.headers.set_all('Set-Cookie', cookies)